Cloud-delivered FMC
- 5 months ago
"Best practices" will vary from user to user based on the parameters you have to work in, so I can't guide you to a definite answer there. If you're looking at the existing "pre-made" integrations for SL1, you'll have much more depth of monitoring with SNMP and/or Linux Base Pack to monitor FirePower devices. If you want to spend some time to whip up some REST API based dynamic applications to pull data from FMC and those other caveats I shared don't bother you, then that's a totally reasonable path to take as well. It mostly depends on what level of monitoring you're looking for and at what scale.
Creating a dynamic application to authenticate with FMC and collect the list of managed devices with basic config would be pretty simple and scale well, so if that's all you want, that's a reasonable approach. If you want detailed interface, cpu, memory and other performance metrics at the 1 minute or 5 minute interval along with collecting alarms, topology, and other things, then going through the FMC API may be the more difficult path as opposed to Cisco Base Pack and Linux Base Pack for each appliance.
Usually the "ideal" path is like you mentioned, Use the API to pull high level data (that may only be available in the API), then use SNMP/SSH directly to the appliances for the high fidelity, high volume data. If you choose to model the appliances through the rest API collections as components, you can merge those with the physical devices discovered via IP address in SL1.
If FirePower devices turn off connectivity features when in a managed mode, that does "throw a wrench" in things, and you will have to make some decisions on the fidelity and volume of monitoring you desire.